Protect a stored key object
05A JWK or JWK Set can itself be encrypted using JWE.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7 ↗
RFC 7517 · § 7EXAMPLE
3 / 3
03
Authorized recovery
Decrypt and authenticate before exposing key material to the intended operation.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Encryption protects serialized key information only when the surrounding key-management design is sound.
- Encryption protects serialized key information only when the surrounding key-management design is sound.
- The protected content type identifies jwk+json or jwk-set+json.
- Authenticated provenance and permission checks still matter after decryption.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy